CVE-2019-7610 Code injection in Kibana
Attackers can execute arbitrary code on Kibana servers if the security audit logger is enabled, potentially compromising the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-7610?
CVE-2019-7610 is a critical code injection vulnerability in Elastic Kibana, published on 25 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Which versions are affected by CVE-2019-7610?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2019-7610?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-7610 being exploited?
There is no known exploitation of CVE-2019-7610 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-rrx3-4wcg-f297.